The number of devices connected to the Internet has been increasing with the emergence of the Internet of things technology. Although it has many advantages, the weak configuration of Internet of things devices and the higher number of such devices provide a good potential for DDoS (Distributed Denial-of-Service) attacks. In this study, an approach based on SDN (Software Defined Network) and NFV (Network Functions Virtualization) technologies were presented for the purpose of network forensics and DDoS attack detection. In this approach, the entropy-based methods were used as a warning for DDoS attacks. The methods of detecting the fake IP address of the message source and a method based on correlation coefficient were used for separating the legal traffic from allowed traffic from non-allowed traffic. In addition, NFV technology was used for allocating more resources dynamically.